Skip to content

[agent-sandbox] fix jwtPublicKey breaking job-template JSON (use toJson) #325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JatinNanda merged 1 commit into from
Jun 11, 2026
Merged

[agent-sandbox] fix jwtPublicKey breaking job-template JSON (use toJson) #325

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions charts/retool/ci/test-agent-sandbox-inline-secrets-option.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,9 @@ rr:
# proxy ingress). Here we exercise the *other* halves of those branches:
# - Secrets inline (no externalSecret.name) → the chart renders its own Secret
# (jwt-public-key / jwt-private-key / encryption-key / api-secret). jwtPublicKey
# MUST be single-line: it is injected raw into the sandbox job-template JSON.
# is injected into the sandbox job-template JSON via `toJson`, so a genuine
# multi-line PEM (real newlines, as below) is escaped correctly — no need to
# pre-flatten it to a single `\n`-escaped line.
# - Postgres sourcing OPTION 1: plaintext DSN via postgres.url.
# - Same-origin proxy: no dedicated proxy domain and no proxy ingress — the
# backend reverse-proxies /sandbox/* (frontendWsProxyDomain left empty).
Expand All @@ -21,8 +23,19 @@ rr:
tag: 3.123.4
pullPolicy: IfNotPresent

jwtPublicKey: '-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEljtqa2nhBwe/PqNhWgPHhj0jv8AI\nY+QUCicYtfv9wLGcEGPQuXoBQtuoIuOwXOdbEWgrQyLdIEb0YjegAW3miA==\n-----END PUBLIC KEY-----'
jwtPrivateKey: '-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIMFXLiN/YsJv89D2YkEZ6/Dj5fujghENmYTOilwdChU3oAoGCCqGSM49\nAwEHoUQDQgAEljtqa2nhBwe/PqNhWgPHhj0jv8AIY+QUCicYtfv9wLGcEGPQuXoB\nQtuoIuOwXOdbEWgrQyLdIEb0YjegAW3miA==\n-----END EC PRIVATE KEY-----'
# Real multi-line PEM (block scalar) — exercises the toJson newline escaping in
# the job-template JSON. A raw "{{ . }}" would produce invalid JSON here.
jwtPublicKey: |-
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEljtqa2nhBwe/PqNhWgPHhj0jv8AI
Y+QUCicYtfv9wLGcEGPQuXoBQtuoIuOwXOdbEWgrQyLdIEb0YjegAW3miA==
-----END PUBLIC KEY-----
jwtPrivateKey: |-
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIMFXLiN/YsJv89D2YkEZ6/Dj5fujghENmYTOilwdChU3oAoGCCqGSM49
AwEHoUQDQgAEljtqa2nhBwe/PqNhWgPHhj0jv8AIY+QUCicYtfv9wLGcEGPQuXoB
QtuoIuOwXOdbEWgrQyLdIEb0YjegAW3miA==
-----END EC PRIVATE KEY-----
encryptionKey: a12b01429fe0fe69a80da94e9e837ab2f1e9bda378ed8a25905a238f6fea6b7a
apiSecret: test-agent-sandbox-api-secret

Expand Down
2 changes: 1 addition & 1 deletion charts/retool/templates/deployment_agent_sandbox.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ data:
,{"name": "SANDBOX_GLOBAL_LIFETIME_MS", "value": "{{ $as.sandbox.sandboxGlobalLifetimeMs }}"}
,{"name": "SANDBOX_READY_TIMEOUT_MS", "value": "{{ $as.sandbox.sandboxReadyTimeoutMs }}"}
{{- if $as.jwtPublicKey }}
,{"name": "AGENT_SANDBOX_JWT_PUBLIC_KEY", "value": "{{ $as.jwtPublicKey }}"}
,{"name": "AGENT_SANDBOX_JWT_PUBLIC_KEY", "value": {{ $as.jwtPublicKey | toJson }}}
{{- else if $as.externalSecret.name }}
,{"name": "AGENT_SANDBOX_JWT_PUBLIC_KEY", "valueFrom": {"secretKeyRef": {"name": "{{ $defaultSecretName }}", "key": "jwt-public-key"}}}
{{- end }}
Expand Down
Loading